CVE-2020-3263: Cisco Webex Meetings Desktop App URL Filtering Arbitrary Program Execution Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-18 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in Cisco Webex Meetings Desktop App could allow an unauthenticated, remote attacker to execute programs on an affected end-user system. The vulnerability is due to improper validation of input that is supplied to application URLs. The attacker could exploit this vulnerability by persuading a user to follow a malicious URL. A successful exploit could allow the attacker to cause the application to execute other programs that are already present on the end-user system. If malicious files are planted on the system or on an accessible network file path, the attacker could execute arbitrary code on the affected system.

Affected products

Cisco Webex Meetings: before 39.5.12 — fixed in 39.5.12

How to fix

Upgrade to a fixed version: Cisco Webex Meetings 39.5.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3263 or the next vulnerability affects your stack